Attackers are probing the critical PHP2Shell vulnerabilities to deploy Mirai-derived malware, while researchers have demonstrated an exploit that can bypass address space layout randomization (ASLR) on production-configured PHP servers. The activity has not yet produced a publicly confirmed successful compromise, but it shows that a major obstacle to weaponizing the flaws is being removed.
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP engine memory-safety vulnerabilities that permit unauthenticated remote code execution through specially crafted HTTP requests. The PHP project describes the first as an out-of-memory state-corruption flaw and the second as stale global state resulting from fatal-error handling. Both carry a critical CVSS v4.0 score of 9.2, according to the project’s security advisory. [16]
The bugs affect PHP installations that process web requests, including PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP and LiteSpeed. PHP’s fixes were released on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project says the risk is highest for Apache deployments using mod_php, where exploitation can occur before application code runs, and warns that there is no complete mitigation other than updating. [17][18]
Security researchers have observed scanning and exploit attempts associated with more than one malware operation. Cobalt linked some activity to a Mirai botnet, while Arctic Wolf separately reported attempts associated with the Potassium botnet, according to The Record. Sophos described a Mirai-derived sample with downloader and network-disruption capabilities, but the available reporting does not establish a single responsible threat actor or confirm that any targeted PHP server was successfully compromised. [10]
The ASLR development raises the operational risk. VulnCheck said its proof of concept for CVE-2026-109618 uses a memory leak to disclose addresses and achieve code execution on x86-64 systems even when PHP error display is disabled, a setting commonly used in production. Separately, SOCRadar described an attack script that recycles a PHP worker, leaks memory through a session cookie and abuses session-upload-progress handling to execute commands. Those findings demonstrate exploitability, but they should not be treated as evidence of confirmed in-the-wild compromise. [7][12]
Defenders should inventory every internet-facing PHP runtime, identify installations below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and apply the corresponding update immediately. Teams should also review web-server, PHP-FPM and endpoint telemetry for unusual out-of-memory errors, worker restarts, malformed session requests, unexpected command execution and outbound connections associated with Mirai-like payloads. Systems that cannot be patched should be removed from public exposure while organizations investigate logs for exploitation attempts.
References
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- Reports of PHP bug exploitation attempts grow as experts …
- PHP2Shell: two critical PHP flaws put 34 million web services on the clock
- News Archive – 2026 – PHP
- PHP
- php.general: PHP 8.4.27 Released
